From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 74C82490BE5 for ; Fri, 14 Aug 2026 17:15:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786727714; cv=none; b=POn5M7sTnorK46d77LUpdG1lYmJ/KwyEPNY7GH2noquHmoKjX58n3WzriNuryd0r39aVoNnyLdtMHUOmt7KOHkcQ8GCN3RFcG+rEf36Dt5JNOQIskYkDKijj46SEGDdHiKN2d94VF4Gem+GlmA+DPV6suwhkdO/m98TW9QNeD0c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786727714; c=relaxed/simple; bh=cfNdoi/AqbEIVL76btp+PnG/b1pUWqSOkrGjxL5ZOBg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Q542sSq/nqbKtXAC6WT+4SnBe/jxAazQOqQCwArFOz2JCGFhUVXaWX+Wke8bsLfiT3NpZXI3xq6uRXwA4SqkelKCwRhzMhIN7rb30MxzOlAHM9u2SIlIbNtWVHbWRP/PznnAgwbensl/QNkhwWRXMnXiNH+GK9F9a0EC8BXN9ws= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BpN+FNqd; arc=none smtp.client-ip=209.85.214.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BpN+FNqd" Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2ce87c7e3bbso16523195ad.1 for ; Fri, 14 Aug 2026 10:15:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786727711; x=1787332511; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=eKznlJprVtfE3nfFItk+Tbwr9vjYBvhEz5q6vw5jWcA=; b=BpN+FNqdSwKB/udnSuiQ5QR22t7NI+5WpZYaMi/vgQ5WTG2XMMj/a/UxeQ6SOkJEGf qD/6rN3wctArCTnZhuJNsKXlRaohDjn0DM2kmMv3fY0tn+DXxvhg+ZRKnwIh13OebfNs 38bJJsUnQVGy3CKYByWB3DLcCrq1Xm1lN1aOLSkpldDdABtJMc6hFFUNyTNbPaip61rN 4Av0Wfnph4XCQCPzZHHbokPJKUnvq8txzoE2aABiFqDgzXmo8r/cxT/lFAbD1zQR1vXY +WOnetCNgR3T/1EB/3ceHO+TmfbLlP668g5pttGKfR2cBkKtWHH+8g7h62bpEa8eDRl1 c/sg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786727711; x=1787332511; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=eKznlJprVtfE3nfFItk+Tbwr9vjYBvhEz5q6vw5jWcA=; b=M0HgYKqgvQ03rnNM81MkdSLtVg3Gk0E0kyR7XIXnYjkwHRDjFvG9pRb2/CNr836v18 qMvs3X1u1U+5y1O59aUUJlKD50M3lRCzmfup4rEBMcsDf4DpAngs9WP4LtFEbRexim2h yqKCKK2wNSP+4jtXTtwnoAAkOAhE+4MYh9kT56Ep6AnEFL015+08dou42GpOB1hmpuXJ NIABkjMEzp4xIDp5SmxFJhTbe5yzeOo7XNpQbL0tw7/cT+yMzfBzUa8AxJks+FF391H0 Mi6g/cI9rZ8QV8InBNwQzHxDZH1cPkmIRNyb7GrJ2dp5qVwU+BOFz2Zkblt3CSE2ZUPY aJ4A== X-Forwarded-Encrypted: i=1; AHgh+Rr2iHDRBoOvcE37P1mYjIBdDRzcn7YlbBTEZR0WlMaPRR2pGPRDlGrfcD37Hq9JUpt6gBd1w+fBZamjaQw=@vger.kernel.org X-Gm-Message-State: AOJu0Yzxm9JvaXQaUA+iNz17a/Tj2TCOaHPKw85x+i+/bJkA2RtzrIyD Atgy9TEIVmTjbFMosIlC61eurfZNkWJ6kOJDpCi8FQ8ozX8YKv3YRDFA X-Gm-Gg: AR+sD11lsxfwjJHzw9XFqVSheUdOt6ZGKyRyuB4QyCr/Sv15AuSmf5TF0q0ZZoYVfPE Cvv1h2KRQ+wBoteOZguG5yeSeIHLazuL3Cf1msMU3nLK7w5wNWuAoYQFDGvB+tNc9CkIVgkeM4K OssQEmiBmyBoBTqtEO1jnWggC8WzhPjzaU3RJTdDYvvuHEgWYufg2chi0LLsfUdHiK3t0I5vnvz HvKWSSzUDm5rt+tgIz+Z48BKCiMJJL1zDvbCJAdAqMd5NUY++O67HODsmjJdZLJ/MDFKxTJrXeT HjM8yM8TLHqiau+vHfIT41/pxnBk+YWmca7XiXii4tI//LXtRS8zAVHbt3QDfo+Sh1BhveIfx6+ TkwNe5D7cp/uvmvcN8+2pxDgh5Y/VAoPrkKNkaMA7UP0plnVgqFvF/3OTQ+HWrYyNx0vj2Z1PLy QQEVFsG66G8tN+DqtQUYt32PHVUyLT7G/PAq54yABcHAkkDqncqoD9cDSH2xY0goBzfUwsgxv6y 6EgulQ+2b+Ot0Eq13WTBnn09VvQiHMKrA+uwfRnoLLnLQE8ik8JZtPQgyBXGgHorbG9r/0Quow5 qWYMixjLrt92OixQeez2u850uN600SXYcqG48ZWpEHLf3B7ELqTkoWa4di3tXKQ/fOJZq3s/bYt ohpA/kPtioHQfsHb1sM4AcI1p6PkN8+8d4zJBLk+d7MgHcu2w X-Received: by 2002:a17:903:2305:b0:2cf:4c0f:5129 with SMTP id d9443c01a7336-2d3b0cd91a1mr81765805ad.17.1786727711423; Fri, 14 Aug 2026 10:15:11 -0700 (PDT) Received: from localhost.localdomain ([101.251.7.10]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-320ea2f787fsm6182234eec.20.2026.08.14.10.15.07 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 14 Aug 2026 10:15:10 -0700 (PDT) From: Laxman Acharya Padhya To: linux-bluetooth@vger.kernel.org Cc: marcel@holtmann.org, luiz.dentz@gmail.com, linux-kernel@vger.kernel.org, ali@iusegentoo.com, raghuram.hegde@intel.com, kiraank@gmail.com, kiran.k@intel.com, ravishankar.srivatsa@intel.com, amit.k.bag@intel.com Subject: [PATCH v2 0/3] Bluetooth: btintel: harden version TLV parsing Date: Fri, 14 Aug 2026 23:00:00 +0545 Message-ID: <20260814171503.42684-1-acharyalaxman8848@gmail.com> X-Mailer: git-send-email 2.51.2 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Malformed Intel version TLVs can make btintel_parse_version_tlv() read beyond the received response. Validate the minimum value length for each known fixed-size TLV and bound the firmware ID conversion by the TLV's advertised length. Propagate parser failures to the setup path in a separate patch. The two bounds fixes are kept separate because they were introduced by different commits and apply to different stable trees. The parser error propagation is also separate because it changes setup behavior. Changes in v2: - split the minimum-length validation and firmware ID bounds fix - use the appropriate Fixes tag for each bounds fix - keep parser error propagation as a separate behavioral change - add Ali's Reviewed-by tag to the two bounds fixes Laxman Acharya Padhya (3): Bluetooth: btintel: validate version TLV value lengths Bluetooth: btintel: bound firmware ID by TLV length Bluetooth: btintel: propagate version TLV parsing errors drivers/bluetooth/btintel.c | 44 +++++++++++++++++++++++++++++++++---- 1 file changed, 40 insertions(+), 4 deletions(-) -- 2.51.2